Gateway container deployment
Production operating manual for deploying RedactNode Gateway inside your private VPC or on-premises virtualization cluster.
The RedactNode Gateway is delivered as a hardened, non-root OCI container image. It requires a dedicated in-memory Redis instance for transient session de-tokenization and an optional PostgreSQL database for policy grammars and tamper-evident audit receipts.
1. Prerequisites & Sizing
Verify host machine capabilities prior to launching the stack. Sizing recommendations for baseline production workloads (500 tokens/sec throughput):
2. Docker Compose Blueprint
Save the following specification as docker-compose.yml on your host virtual machine. It orchestrates the gateway worker, authenticated Redis instance, and PostgreSQL database:
version: "3.8"
services:
gateway:
image: ghcr.io/redactnode/gateway:v2.4.1
restart: unless-stopped
ports:
- "8000:8000"
environment:
- PORT=8000
- REDIS_URL=redis://:vault_secret_pass@redis:6379/0
- DATABASE_URL=postgresql://rn_user:db_secret_pass@postgres:5432/redactnode
- VAULT_ENCRYPTION_KEY=${VAULT_ENCRYPTION_KEY}
- SESSION_TTL_SECONDS=900
- SOVEREIGN_AIRGAP_MODE=false
depends_on:
redis:
condition: service_healthy
postgres:
condition: service_healthy
healthcheck:
test: ["CMD", "curl", "-f", "http://localhost:8000/v1/health"]
interval: 10s
timeout: 3s
retries: 3
redis:
image: redis:7.2-alpine
restart: unless-stopped
command: redis-server --requirepass vault_secret_pass --maxmemory 2gb --maxmemory-policy volatile-ttl
healthcheck:
test: ["CMD", "redis-cli", "-a", "vault_secret_pass", "ping"]
interval: 5s
timeout: 3s
retries: 3
postgres:
image: postgres:16-alpine
restart: unless-stopped
environment:
POSTGRES_USER: rn_user
POSTGRES_PASSWORD: db_secret_pass
POSTGRES_DB: redactnode
volumes:
- pgdata:/var/lib/postgresql/data
healthcheck:
test: ["CMD-SHELL", "pg_isready -U rn_user -d redactnode"]
interval: 5s
timeout: 3s
retries: 3
volumes:
pgdata:Generate a cryptographically secure 256-bit vault key and start the cluster:
$ docker compose up -d
3. Environment Variables
Full reference of configuration variables accepted by the RedactNode Gateway container runtime:
| VARIABLE | TYPE | DEFAULT | REQUIRED | PURPOSE |
|---|---|---|---|---|
| PORT | integer | 8000 | optional | Internal HTTP port the gateway worker processes bind to. |
| REDIS_URL | string | redis://127.0.0.1:6379/0 | required | Connection URI for the isolated Redis in-memory token vault. |
| DATABASE_URL | string | - | required | PostgreSQL connection string for policy grammars and audit metadata. |
| VAULT_ENCRYPTION_KEY | string (base64) | - | required | 32-byte (256-bit) master encryption key used for AES-256-GCM token storage. |
| SESSION_TTL_SECONDS | integer | 900 | optional | Token vault session lifetime in seconds (15 min) before automated memory purge. |
| SOVEREIGN_AIRGAP_MODE | boolean | false | optional | When true, disables all outbound internet telemetry and forces local model inference. |
| UPSTREAM_OPENAI_BASE | string | https://api.openai.com/v1 | optional | Upstream foundational model endpoint for proxied chat completions. |
4. Nginx Reverse Proxy (SSE Streaming)
When proxying LLM chat streams through Nginx, buffering must be disabled. Otherwise, tokens will queue up in memory and break realtime interactive user feedback:
server {
listen 443 ssl http2;
server_name gateway.internal.firm;
ssl_certificate /etc/ssl/certs/firm_internal.crt;
ssl_certificate_key /etc/ssl/private/firm_internal.key;
location / {
proxy_pass http://127.0.0.1:8000;
proxy_http_version 1.1;
# Mandatory for streaming SSE chunks without buffering
proxy_set_header Connection '';
proxy_buffering off;
proxy_cache off;
chunked_transfer_encoding off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 300s;
proxy_send_timeout 300s;
}
}5. Health Checks & Verification
Query the container health endpoint to verify database connectivity, Redis ping latency, and tokenizer engine readiness:
{
"status": "healthy",
"version": "2.4.1",
"database": "connected",
"redis_vault": "connected",
"tokenizer_rules": 14,
"uptime_seconds": 18420
}